CVE-2023-24775
📋 TL;DR
Funadmin v3.2.0 contains a SQL injection vulnerability in the selectFields parameter at /member/Member.php that allows attackers to execute arbitrary SQL commands. This affects all installations running the vulnerable version. Attackers can potentially access, modify, or delete database content.
💻 Affected Systems
- Funadmin
📦 What is this software?
Funadmin by Funadmin
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution via database functions.
Likely Case
Unauthorized data access and extraction, including sensitive user information, configuration data, and potentially credential theft.
If Mitigated
Limited impact with proper input validation and parameterized queries in place, potentially only error messages or minimal data exposure.
🎯 Exploit Status
SQL injection via selectFields parameter is straightforward to exploit with common SQL injection tools. Public GitHub issue demonstrates the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.2.1 or later
Vendor Advisory: https://github.com/funadmin/funadmin/issues/9
Restart Required: No
Instructions:
1. Backup your current installation. 2. Download the latest version from the official repository. 3. Replace vulnerable files with patched versions. 4. Verify the fix by testing the selectFields parameter.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to reject malicious SQL characters in the selectFields parameter
Modify /member/Member.php to sanitize selectFields input using preg_replace('/[^a-zA-Z0-9_,\s]/', '', $selectFields)
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
Add WAF rule: deny requests containing SQL keywords (SELECT, UNION, etc.) in selectFields parameter
🧯 If You Can't Patch
- Disable or restrict access to the /member/Member.php endpoint
- Implement network segmentation and strict access controls to limit exposure
🔍 How to Verify
Check if Vulnerable:
Test the selectFields parameter with SQL injection payloads like: selectFields=1' OR '1'='1Check Version:
Check Funadmin version in configuration files or admin panelVerify Fix Applied:
Test with same payloads after patching; should return error or sanitized response instead of executing SQL📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts following SQL errors
- Requests with SQL keywords in selectFields parameter
Network Indicators:
- HTTP requests containing SQL injection patterns in parameters
- Unusual database connection patterns from web server
SIEM Query:
web.url:*Member.php* AND web.param.selectFields:(SELECT OR UNION OR ' OR ")